From bf341e9166e16cefd638e2facc0a024be257ca95 Mon Sep 17 00:00:00 2001
From: dawn <dawn@tangled.org>
Date: Mon, 21 Sep 2026 15:29:13 +0300
Subject: [PATCH] .tangled/workflows: mint a token from the credential instead
 of assuming a gcloud account

Signed-off-by: dawn <dawn@tangled.org>
---
 .tangled/workflows/deploy-gcp-dev.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.tangled/workflows/deploy-gcp-dev.yml b/.tangled/workflows/deploy-gcp-dev.yml
index 7a3331b32..e9a0e07d1 100644
--- a/.tangled/workflows/deploy-gcp-dev.yml
+++ b/.tangled/workflows/deploy-gcp-dev.yml
@@ -40,11 +40,13 @@ steps:
       set -eu
       mkdir -p ~/.config/gcloud
       printf '%s' "$GCP_CI_CREDENTIALS" > ~/.config/gcloud/application_default_credentials.json
+      gcloud auth application-default set-quota-project "$GCP_PROJECT" --quiet
       gcloud config set project "$GCP_PROJECT" --quiet
-      gcloud config set auth/impersonate_service_account "$CI_SERVICE_ACCOUNT" --quiet
-      gcloud auth configure-docker "$GCP_REGION-docker.pkg.dev" --quiet
-      # fail fast if auth is dead
-      gcloud auth print-access-token >/dev/null
+      gcloud auth application-default print-access-token \
+        --impersonate-service-account="$CI_SERVICE_ACCOUNT" > "$HOME/.gcp-token"
+      chmod 600 "$HOME/.gcp-token"
+      docker login --username=oauth2accesstoken \
+        --password="$(cat "$HOME/.gcp-token")" "$GCP_REGION-docker.pkg.dev"
 
   # bobbin's Containerfile copies from the repo root, so the root is the context
   - name: build and push bobbin
@@ -82,6 +84,7 @@ steps:
   - name: deploy
     command: |
       set -eu
+      export CLOUDSDK_AUTH_ACCESS_TOKEN="$(cat "$HOME/.gcp-token")"
       dep="projects/$GCP_PROJECT/locations/$GCP_REGION/deployments/$DEPLOYMENT"
 
       src=$(gcloud infra-manager deployments describe "$dep" \
-- 
2.51.2